From da4b03cd7a93d4339abded4bfa442d123a17de7b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 27 Nov 2021 13:46:54 +0100 Subject: [PATCH] 5.10-stable patches added patches: acpi-get-acpi_device-s-parent-from-the-parent-field.patch net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch usb-dwc3-gadget-fix-null-pointer-exception.patch usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch usb-hub-fix-locking-issues-with-address0_mutex.patch usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch usb-serial-option-add-fibocom-fm101-gl-variants.patch usb-serial-option-add-telit-le910s1-0x9200-composition.patch usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch --- ...evice-s-parent-from-the-parent-field.patch | 51 ++ ...dereference-when-ipv6-is-not-enabled.patch | 105 +++ queue-5.10/series | 13 + ...l-error-pointer-dereference-in-probe.patch | 50 ++ ...get-fix-isoc-flow-for-elapsed-frames.patch | 82 +++ ...ue-fix-use-of-floating-point-literal.patch | 56 ++ ...heck-for-l1-l2-u3-for-start-transfer.patch | 62 ++ ...c3-gadget-fix-null-pointer-exception.patch | 48 ++ ...t-ignore-nostream-after-end-transfer.patch | 58 ++ ...x-locking-issues-with-address0_mutex.patch | 104 +++ ...umeration-issue-due-to-address0-race.patch | 108 +++ ...option-add-fibocom-fm101-gl-variants.patch | 688 ++++++++++++++++++ ...add-telit-le910s1-0x9200-composition.patch | 33 + ...-of-comparator-and-bc_lvl-interrupts.patch | 66 ++ 14 files changed, 1524 insertions(+) create mode 100644 queue-5.10/acpi-get-acpi_device-s-parent-from-the-parent-field.patch create mode 100644 queue-5.10/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch create mode 100644 queue-5.10/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch create mode 100644 queue-5.10/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch create mode 100644 queue-5.10/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch create mode 100644 queue-5.10/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch create mode 100644 queue-5.10/usb-dwc3-gadget-fix-null-pointer-exception.patch create mode 100644 queue-5.10/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch create mode 100644 queue-5.10/usb-hub-fix-locking-issues-with-address0_mutex.patch create mode 100644 queue-5.10/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch create mode 100644 queue-5.10/usb-serial-option-add-fibocom-fm101-gl-variants.patch create mode 100644 queue-5.10/usb-serial-option-add-telit-le910s1-0x9200-composition.patch create mode 100644 queue-5.10/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch diff --git a/queue-5.10/acpi-get-acpi_device-s-parent-from-the-parent-field.patch b/queue-5.10/acpi-get-acpi_device-s-parent-from-the-parent-field.patch new file mode 100644 index 00000000000..1cc7002f3ea --- /dev/null +++ b/queue-5.10/acpi-get-acpi_device-s-parent-from-the-parent-field.patch @@ -0,0 +1,51 @@ +From 9054fc6d57e80c27c0b0632966416144f2092c2b Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 17 Nov 2021 20:07:34 +0200 +Subject: ACPI: Get acpi_device's parent from the parent field + +From: Sakari Ailus + +commit 9054fc6d57e80c27c0b0632966416144f2092c2b upstream. + +Printk modifier %pfw is used to print the full path of the device name. +This is obtained device by device until a device no longer has a parent. + +On ACPI getting the parent fwnode is done by calling acpi_get_parent() +which tries to down() a semaphore. But local IRQs are now disabled in +vprintk_store() before the mutex is acquired. This is obviously a problem. + +Luckily struct device, embedded in struct acpi_device, has a parent field +already. Use that field to get the parent instead of relying on +acpi_get_parent(). + +Fixes: 3bd32d6a2ee6 ("lib/vsprintf: Add %pfw conversion specifier for printing fwnode names") +Cc: 5.5+ # 5.5+ +Signed-off-by: Sakari Ailus +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/property.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -1110,15 +1110,10 @@ struct fwnode_handle *acpi_node_get_pare + /* All data nodes have parent pointer so just return that */ + return to_acpi_data_node(fwnode)->parent; + } else if (is_acpi_device_node(fwnode)) { +- acpi_handle handle, parent_handle; ++ struct device *dev = to_acpi_device_node(fwnode)->dev.parent; + +- handle = to_acpi_device_node(fwnode)->handle; +- if (ACPI_SUCCESS(acpi_get_parent(handle, &parent_handle))) { +- struct acpi_device *adev; +- +- if (!acpi_bus_get_device(parent_handle, &adev)) +- return acpi_fwnode_handle(adev); +- } ++ if (dev) ++ return acpi_fwnode_handle(to_acpi_device(dev)); + } + + return NULL; diff --git a/queue-5.10/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch b/queue-5.10/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch new file mode 100644 index 00000000000..bdda0cdd1d7 --- /dev/null +++ b/queue-5.10/net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch @@ -0,0 +1,105 @@ +From 1c743127cc54b112b155f434756bd4b5fa565a99 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Tue, 23 Nov 2021 12:27:19 +0200 +Subject: net: nexthop: fix null pointer dereference when IPv6 is not enabled + +From: Nikolay Aleksandrov + +commit 1c743127cc54b112b155f434756bd4b5fa565a99 upstream. + +When we try to add an IPv6 nexthop and IPv6 is not enabled +(!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path +of nh_create_ipv6() due to calling ipv6_stub->fib6_nh_release. The bug +has been present since the beginning of IPv6 nexthop gateway support. +Commit 1aefd3de7bc6 ("ipv6: Add fib6_nh_init and release to stubs") tells +us that only fib6_nh_init has a dummy stub because fib6_nh_release should +not be called if fib6_nh_init returns an error, but the commit below added +a call to ipv6_stub->fib6_nh_release in its error path. To fix it return +the dummy stub's -EAFNOSUPPORT error directly without calling +ipv6_stub->fib6_nh_release in nh_create_ipv6()'s error path. + +[1] + Output is a bit truncated, but it clearly shows the error. + BUG: kernel NULL pointer dereference, address: 000000000000000000 + #PF: supervisor instruction fetch in kernel modede + #PF: error_code(0x0010) - not-present pagege + PGD 0 P4D 0 + Oops: 0010 [#1] PREEMPT SMP NOPTI + CPU: 4 PID: 638 Comm: ip Kdump: loaded Not tainted 5.16.0-rc1+ #446 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 + RIP: 0010:0x0 + Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. + RSP: 0018:ffff888109f5b8f0 EFLAGS: 00010286^Ac + RAX: 0000000000000000 RBX: ffff888109f5ba28 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881008a2860 + RBP: ffff888109f5b9d8 R08: 0000000000000000 R09: 0000000000000000 + R10: ffff888109f5b978 R11: ffff888109f5b948 R12: 00000000ffffff9f + R13: ffff8881008a2a80 R14: ffff8881008a2860 R15: ffff8881008a2840 + FS: 00007f98de70f100(0000) GS:ffff88822bf00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffffffffffffd6 CR3: 0000000100efc000 CR4: 00000000000006e0 + Call Trace: + + nh_create_ipv6+0xed/0x10c + rtm_new_nexthop+0x6d7/0x13f3 + ? check_preemption_disabled+0x3d/0xf2 + ? lock_is_held_type+0xbe/0xfd + rtnetlink_rcv_msg+0x23f/0x26a + ? check_preemption_disabled+0x3d/0xf2 + ? rtnl_calcit.isra.0+0x147/0x147 + netlink_rcv_skb+0x61/0xb2 + netlink_unicast+0x100/0x187 + netlink_sendmsg+0x37f/0x3a0 + ? netlink_unicast+0x187/0x187 + sock_sendmsg_nosec+0x67/0x9b + ____sys_sendmsg+0x19d/0x1f9 + ? copy_msghdr_from_user+0x4c/0x5e + ? rcu_read_lock_any_held+0x2a/0x78 + ___sys_sendmsg+0x6c/0x8c + ? asm_sysvec_apic_timer_interrupt+0x12/0x20 + ? lockdep_hardirqs_on+0xd9/0x102 + ? sockfd_lookup_light+0x69/0x99 + __sys_sendmsg+0x50/0x6e + do_syscall_64+0xcb/0xf2 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f98dea28914 + Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 48 8d 05 e9 5d 0c 00 8b 00 85 c0 75 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 41 89 d4 55 48 89 f5 53 + RSP: 002b:00007fff859f5e68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e2e + RAX: ffffffffffffffda RBX: 00000000619cb810 RCX: 00007f98dea28914 + RDX: 0000000000000000 RSI: 00007fff859f5ed0 RDI: 0000000000000003 + RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000008 + R10: fffffffffffffce6 R11: 0000000000000246 R12: 0000000000000001 + R13: 000055c0097ae520 R14: 000055c0097957fd R15: 00007fff859f63a0 + + Modules linked in: bridge stp llc bonding virtio_net + +Cc: stable@vger.kernel.org +Fixes: 53010f991a9f ("nexthop: Add support for IPv6 gateways") +Signed-off-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/nexthop.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/net/ipv4/nexthop.c ++++ b/net/ipv4/nexthop.c +@@ -1355,11 +1355,15 @@ static int nh_create_ipv6(struct net *ne + /* sets nh_dev if successful */ + err = ipv6_stub->fib6_nh_init(net, fib6_nh, &fib6_cfg, GFP_KERNEL, + extack); +- if (err) ++ if (err) { ++ /* IPv6 is not enabled, don't call fib6_nh_release */ ++ if (err == -EAFNOSUPPORT) ++ goto out; + ipv6_stub->fib6_nh_release(fib6_nh); +- else ++ } else { + nh->nh_flags = fib6_nh->fib_nh_flags; +- ++ } ++out: + return err; + } + diff --git a/queue-5.10/series b/queue-5.10/series index 3b9b10d6118..4236a540a00 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,14 @@ bpf-fix-toctou-on-read-only-map-s-constant-scalar-tracking.patch +acpi-get-acpi_device-s-parent-from-the-parent-field.patch +usb-serial-option-add-telit-le910s1-0x9200-composition.patch +usb-serial-option-add-fibocom-fm101-gl-variants.patch +usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch +usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch +usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch +usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch +usb-dwc3-gadget-fix-null-pointer-exception.patch +net-nexthop-fix-null-pointer-dereference-when-ipv6-is-not-enabled.patch +usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch +usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch +usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch +usb-hub-fix-locking-issues-with-address0_mutex.patch diff --git a/queue-5.10/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch b/queue-5.10/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch new file mode 100644 index 00000000000..322f578f155 --- /dev/null +++ b/queue-5.10/usb-chipidea-ci_hdrc_imx-fix-potential-error-pointer-dereference-in-probe.patch @@ -0,0 +1,50 @@ +From d4d2e5329ae9dfd6742c84d79f7d143d10410f1b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 17 Nov 2021 10:49:23 +0300 +Subject: usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe + +From: Dan Carpenter + +commit d4d2e5329ae9dfd6742c84d79f7d143d10410f1b upstream. + +If the first call to devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0) +fails with something other than -ENODEV then it leads to an error +pointer dereference. For those errors we should just jump directly to +the error handling. + +Fixes: 8253a34bfae3 ("usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle") +Cc: stable +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20211117074923.GF5237@kili +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -425,15 +425,15 @@ static int ci_hdrc_imx_probe(struct plat + data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0); + if (IS_ERR(data->phy)) { + ret = PTR_ERR(data->phy); +- if (ret == -ENODEV) { +- data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); +- if (IS_ERR(data->phy)) { +- ret = PTR_ERR(data->phy); +- if (ret == -ENODEV) +- data->phy = NULL; +- else +- goto err_clk; +- } ++ if (ret != -ENODEV) ++ goto err_clk; ++ data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0); ++ if (IS_ERR(data->phy)) { ++ ret = PTR_ERR(data->phy); ++ if (ret == -ENODEV) ++ data->phy = NULL; ++ else ++ goto err_clk; + } + } + diff --git a/queue-5.10/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch b/queue-5.10/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch new file mode 100644 index 00000000000..1e57fd5b72b --- /dev/null +++ b/queue-5.10/usb-dwc2-gadget-fix-isoc-flow-for-elapsed-frames.patch @@ -0,0 +1,82 @@ +From 7ad4a0b1d46b2612f4429a72afd8f137d7efa9a9 Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Thu, 4 Nov 2021 11:36:01 +0400 +Subject: usb: dwc2: gadget: Fix ISOC flow for elapsed frames + +From: Minas Harutyunyan + +commit 7ad4a0b1d46b2612f4429a72afd8f137d7efa9a9 upstream. + +Added updating of request frame number for elapsed frames, +otherwise frame number will remain as previous use of request. +This will allow function driver to correctly track frames in +case of Missed ISOC occurs. + +Added setting request actual length to 0 for elapsed frames. +In Slave mode when pushing data to RxFIFO by dwords, request +actual length incrementing accordingly. But before whole packet +will be pushed into RxFIFO and send to host can occurs Missed +ISOC and data will not send to host. So, in this case request +actual length should be reset to 0. + +Fixes: 91bb163e1e4f ("usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave") +Cc: stable +Reviewed-by: John Keeping +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/c356baade6e9716d312d43df08d53ae557cb8037.1636011277.git.Minas.Harutyunyan@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -1198,6 +1198,8 @@ static void dwc2_hsotg_start_req(struct + } + ctrl |= DXEPCTL_CNAK; + } else { ++ hs_req->req.frame_number = hs_ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA); + return; + } +@@ -2856,9 +2858,12 @@ static void dwc2_gadget_handle_ep_disabl + + do { + hs_req = get_ep_head(hs_ep); +- if (hs_req) ++ if (hs_req) { ++ hs_req->req.frame_number = hs_ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, + -ENODATA); ++ } + dwc2_gadget_incr_frame_num(hs_ep); + /* Update current frame number value. */ + hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg); +@@ -2911,8 +2916,11 @@ static void dwc2_gadget_handle_out_token + + while (dwc2_gadget_target_frame_elapsed(ep)) { + hs_req = get_ep_head(ep); +- if (hs_req) ++ if (hs_req) { ++ hs_req->req.frame_number = ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, ep, hs_req, -ENODATA); ++ } + + dwc2_gadget_incr_frame_num(ep); + /* Update current frame number value. */ +@@ -3001,8 +3009,11 @@ static void dwc2_gadget_handle_nak(struc + + while (dwc2_gadget_target_frame_elapsed(hs_ep)) { + hs_req = get_ep_head(hs_ep); +- if (hs_req) ++ if (hs_req) { ++ hs_req->req.frame_number = hs_ep->target_frame; ++ hs_req->req.actual = 0; + dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA); ++ } + + dwc2_gadget_incr_frame_num(hs_ep); + /* Update current frame number value. */ diff --git a/queue-5.10/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch b/queue-5.10/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch new file mode 100644 index 00000000000..87f168d57ee --- /dev/null +++ b/queue-5.10/usb-dwc2-hcd_queue-fix-use-of-floating-point-literal.patch @@ -0,0 +1,56 @@ +From 310780e825f3ffd211b479b8f828885a6faedd63 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 5 Nov 2021 07:58:03 -0700 +Subject: usb: dwc2: hcd_queue: Fix use of floating point literal + +From: Nathan Chancellor + +commit 310780e825f3ffd211b479b8f828885a6faedd63 upstream. + +A new commit in LLVM causes an error on the use of 'long double' when +'-mno-x87' is used, which the kernel does through an alias, +'-mno-80387' (see the LLVM commit below for more details around why it +does this). + + drivers/usb/dwc2/hcd_queue.c:1744:25: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it + delay = ktime_set(0, DWC2_RETRY_WAIT_DELAY); + ^ + drivers/usb/dwc2/hcd_queue.c:62:34: note: expanded from macro 'DWC2_RETRY_WAIT_DELAY' + #define DWC2_RETRY_WAIT_DELAY (1 * 1E6L) + ^ + 1 error generated. + +This happens due to the use of a 'long double' literal. The 'E6' part of +'1E6L' causes the literal to be a 'double' then the 'L' suffix promotes +it to 'long double'. + +There is no visible reason for a floating point value in this driver, as +the value is only used as a parameter to a function that expects an +integer type. Use NSEC_PER_MSEC, which is the same integer value as +'1E6L', to avoid changing functionality but fix the error. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1497 +Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36d1f0cadd7801d83 +Fixes: 6ed30a7d8ec2 ("usb: dwc2: host: use hrtimer for NAK retries") +Cc: stable +Reviewed-by: Nick Desaulniers +Reviewed-by: John Keeping +Acked-by: Minas Harutyunyan +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20211105145802.2520658-1-nathan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd_queue.c ++++ b/drivers/usb/dwc2/hcd_queue.c +@@ -59,7 +59,7 @@ + #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5)) + + /* If we get a NAK, wait this long before retrying */ +-#define DWC2_RETRY_WAIT_DELAY 1*1E6L ++#define DWC2_RETRY_WAIT_DELAY (1 * NSEC_PER_MSEC) + + /** + * dwc2_periodic_channel_available() - Checks that a channel is available for a diff --git a/queue-5.10/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch b/queue-5.10/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch new file mode 100644 index 00000000000..538e6ec324a --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-check-for-l1-l2-u3-for-start-transfer.patch @@ -0,0 +1,62 @@ +From 63c4c320ccf77074ffe9019ac596603133c1b517 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 25 Oct 2021 16:35:06 -0700 +Subject: usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer + +From: Thinh Nguyen + +commit 63c4c320ccf77074ffe9019ac596603133c1b517 upstream. + +The programming guide noted that the driver needs to verify if the link +state is in U0 before executing the Start Transfer command. If it's not +in U0, the driver needs to perform remote wakeup. This is not accurate. +If the link state is in U1/U2, then the controller will not respond to +link recovery request from DCTL.ULSTCHNGREQ. The Start Transfer command +will trigger a link recovery if it is in U1/U2. A clarification will be +added to the programming guide for all controller versions. + +The current implementation shouldn't cause any functional issue. It may +occasionally report an invalid time out warning from failed link +recovery request. The driver will still go ahead with the Start Transfer +command if the remote wakeup fails. The new change only initiates remote +wakeup where it is needed, which is when the link state is in L1/L2/U3. + +Fixes: c36d8e947a56 ("usb: dwc3: gadget: put link to U0 before Start Transfer") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/05b4a5fbfbd0863fc9b1d7af934a366219e3d0b4.1635204761.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -310,13 +310,24 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ + if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) { + int link_state; + ++ /* ++ * Initiate remote wakeup if the link state is in U3 when ++ * operating in SS/SSP or L1/L2 when operating in HS/FS. If the ++ * link state is in U1/U2, no remote wakeup is needed. The Start ++ * Transfer command will initiate the link recovery. ++ */ + link_state = dwc3_gadget_get_link_state(dwc); +- if (link_state == DWC3_LINK_STATE_U1 || +- link_state == DWC3_LINK_STATE_U2 || +- link_state == DWC3_LINK_STATE_U3) { ++ switch (link_state) { ++ case DWC3_LINK_STATE_U2: ++ if (dwc->gadget->speed >= USB_SPEED_SUPER) ++ break; ++ ++ fallthrough; ++ case DWC3_LINK_STATE_U3: + ret = __dwc3_gadget_wakeup(dwc); + dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n", + ret); ++ break; + } + } + diff --git a/queue-5.10/usb-dwc3-gadget-fix-null-pointer-exception.patch b/queue-5.10/usb-dwc3-gadget-fix-null-pointer-exception.patch new file mode 100644 index 00000000000..e0ed2da74f0 --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-fix-null-pointer-exception.patch @@ -0,0 +1,48 @@ +From 26288448120b28af1dfd85a6fa6b6d55a16c7f2f Mon Sep 17 00:00:00 2001 +From: Albert Wang +Date: Tue, 9 Nov 2021 17:26:42 +0800 +Subject: usb: dwc3: gadget: Fix null pointer exception + +From: Albert Wang + +commit 26288448120b28af1dfd85a6fa6b6d55a16c7f2f upstream. + +In the endpoint interrupt functions +dwc3_gadget_endpoint_transfer_in_progress() and +dwc3_gadget_endpoint_trbs_complete() will dereference the endpoint +descriptor. But it could be cleared in __dwc3_gadget_ep_disable() +when accessory disconnected. So we need to check whether it is null +or not before dereferencing it. + +Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") +Cc: stable +Reviewed-by: Jack Pham +Signed-off-by: Albert Wang +Link: https://lore.kernel.org/r/20211109092642.3507692-1-albertccwang@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2918,6 +2918,9 @@ static bool dwc3_gadget_endpoint_trbs_co + struct dwc3 *dwc = dep->dwc; + bool no_started_trb = true; + ++ if (!dep->endpoint.desc) ++ return no_started_trb; ++ + dwc3_gadget_ep_cleanup_completed_requests(dep, event, status); + + if (dep->flags & DWC3_EP_END_TRANSFER_PENDING) +@@ -2965,6 +2968,9 @@ static void dwc3_gadget_endpoint_transfe + { + int status = 0; + ++ if (!dep->endpoint.desc) ++ return; ++ + if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) + dwc3_gadget_endpoint_frame_from_event(dep, event); + diff --git a/queue-5.10/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch b/queue-5.10/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch new file mode 100644 index 00000000000..a3fc0c163a5 --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-ignore-nostream-after-end-transfer.patch @@ -0,0 +1,58 @@ +From d74dc3e9f58c28689cef1faccf918e06587367d3 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 25 Oct 2021 16:21:10 -0700 +Subject: usb: dwc3: gadget: Ignore NoStream after End Transfer + +From: Thinh Nguyen + +commit d74dc3e9f58c28689cef1faccf918e06587367d3 upstream. + +The End Transfer command from a stream endpoint will generate a NoStream +event, and we should ignore it. Currently we set the flag +DWC3_EP_IGNORE_NEXT_NOSTREAM to track this prior to sending the command, +and it will be cleared on the next stream event. However, a stream event +may be generated before the End Transfer command completion and +prematurely clear the flag. Fix this by setting the flag on End Transfer +completion instead. + +Fixes: 140ca4cfea8a ("usb: dwc3: gadget: Handle stream transfers") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/cee1253af4c3600edb878d11c9c08b040817ae23.1635203975.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3007,6 +3007,14 @@ static void dwc3_gadget_endpoint_command + if (cmd != DWC3_DEPCMD_ENDTRANSFER) + return; + ++ /* ++ * The END_TRANSFER command will cause the controller to generate a ++ * NoStream Event, and it's not due to the host DP NoStream rejection. ++ * Ignore the next NoStream event. ++ */ ++ if (dep->stream_capable) ++ dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM; ++ + dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + dwc3_gadget_ep_cleanup_cancelled_requests(dep); +@@ -3229,14 +3237,6 @@ static void dwc3_stop_active_transfer(st + WARN_ON_ONCE(ret); + dep->resource_index = 0; + +- /* +- * The END_TRANSFER command will cause the controller to generate a +- * NoStream Event, and it's not due to the host DP NoStream rejection. +- * Ignore the next NoStream event. +- */ +- if (dep->stream_capable) +- dep->flags |= DWC3_EP_IGNORE_NEXT_NOSTREAM; +- + if (!interrupt) + dep->flags &= ~DWC3_EP_TRANSFER_STARTED; + else diff --git a/queue-5.10/usb-hub-fix-locking-issues-with-address0_mutex.patch b/queue-5.10/usb-hub-fix-locking-issues-with-address0_mutex.patch new file mode 100644 index 00000000000..30ae0d7690b --- /dev/null +++ b/queue-5.10/usb-hub-fix-locking-issues-with-address0_mutex.patch @@ -0,0 +1,104 @@ +From 6cca13de26eea6d32a98d96d916a048d16a12822 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 23 Nov 2021 12:16:56 +0200 +Subject: usb: hub: Fix locking issues with address0_mutex + +From: Mathias Nyman + +commit 6cca13de26eea6d32a98d96d916a048d16a12822 upstream. + +Fix the circular lock dependency and unbalanced unlock of addess0_mutex +introduced when fixing an address0_mutex enumeration retry race in commit +ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race") + +Make sure locking order between port_dev->status_lock and address0_mutex +is correct, and that address0_mutex is not unlocked in hub_port_connect +"done:" codepath which may be reached without locking address0_mutex + +Fixes: 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race") +Cc: +Reported-by: Marek Szyprowski +Tested-by: Hans de Goede +Tested-by: Marek Szyprowski +Acked-by: Hans de Goede +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20211123101656.1113518-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5112,6 +5112,7 @@ static void hub_port_connect(struct usb_ + struct usb_port *port_dev = hub->ports[port1 - 1]; + struct usb_device *udev = port_dev->child; + static int unreliable_port = -1; ++ bool retry_locked; + + /* Disconnect any existing devices under this port */ + if (udev) { +@@ -5168,10 +5169,10 @@ static void hub_port_connect(struct usb_ + + status = 0; + +- mutex_lock(hcd->address0_mutex); +- + for (i = 0; i < PORT_INIT_TRIES; i++) { +- ++ usb_lock_port(port_dev); ++ mutex_lock(hcd->address0_mutex); ++ retry_locked = true; + /* reallocate for each attempt, since references + * to the previous one can escape in various ways + */ +@@ -5179,6 +5180,8 @@ static void hub_port_connect(struct usb_ + if (!udev) { + dev_err(&port_dev->dev, + "couldn't allocate usb_device\n"); ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); + goto done; + } + +@@ -5200,13 +5203,13 @@ static void hub_port_connect(struct usb_ + } + + /* reset (non-USB 3.0 devices) and get descriptor */ +- usb_lock_port(port_dev); + status = hub_port_init(hub, udev, port1, i); +- usb_unlock_port(port_dev); + if (status < 0) + goto loop; + + mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ retry_locked = false; + + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); +@@ -5296,11 +5299,14 @@ static void hub_port_connect(struct usb_ + + loop_disable: + hub_port_disable(hub, port1, 1); +- mutex_lock(hcd->address0_mutex); + loop: + usb_ep0_reinit(udev); + release_devnum(udev); + hub_free_dev(udev); ++ if (retry_locked) { ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ } + usb_put_dev(udev); + if ((status == -ENOTCONN) || (status == -ENOTSUPP)) + break; +@@ -5323,8 +5329,6 @@ loop: + } + + done: +- mutex_unlock(hcd->address0_mutex); +- + hub_port_disable(hub, port1, 1); + if (hcd->driver->relinquish_port && !hub->hdev->parent) { + if (status != -ENOTCONN && status != -ENODEV) diff --git a/queue-5.10/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch b/queue-5.10/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch new file mode 100644 index 00000000000..33fde5898b8 --- /dev/null +++ b/queue-5.10/usb-hub-fix-usb-enumeration-issue-due-to-address0-race.patch @@ -0,0 +1,108 @@ +From 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 16 Nov 2021 00:16:30 +0200 +Subject: usb: hub: Fix usb enumeration issue due to address0 race + +From: Mathias Nyman + +commit 6ae6dc22d2d1ce6aa77a6da8a761e61aca216f8b upstream. + +xHC hardware can only have one slot in default state with address 0 +waiting for a unique address at a time, otherwise "undefined behavior +may occur" according to xhci spec 5.4.3.4 + +The address0_mutex exists to prevent this across both xhci roothubs. + +If hub_port_init() fails, it may unlock the mutex and exit with a xhci +slot in default state. If the other xhci roothub calls hub_port_init() +at this point we end up with two slots in default state. + +Make sure the address0_mutex protects the slot default state across +hub_port_init() retries, until slot is addressed or disabled. + +Note, one known minor case is not fixed by this patch. +If device needs to be reset during resume, but fails all hub_port_init() +retries in usb_reset_and_verify_device(), then it's possible the slot is +still left in default state when address0_mutex is unlocked. + +Cc: +Fixes: 638139eb95d2 ("usb: hub: allow to process more usb hub events in parallel") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20211115221630.871204-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4628,8 +4628,6 @@ hub_port_init(struct usb_hub *hub, struc + if (oldspeed == USB_SPEED_LOW) + delay = HUB_LONG_RESET_TIME; + +- mutex_lock(hcd->address0_mutex); +- + /* Reset the device; full speed may morph to high speed */ + /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */ + retval = hub_port_reset(hub, port1, udev, delay, false); +@@ -4940,7 +4938,6 @@ fail: + hub_port_disable(hub, port1, 0); + update_devnum(udev, devnum); /* for disconnect processing */ + } +- mutex_unlock(hcd->address0_mutex); + return retval; + } + +@@ -5170,6 +5167,9 @@ static void hub_port_connect(struct usb_ + unit_load = 100; + + status = 0; ++ ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < PORT_INIT_TRIES; i++) { + + /* reallocate for each attempt, since references +@@ -5206,6 +5206,8 @@ static void hub_port_connect(struct usb_ + if (status < 0) + goto loop; + ++ mutex_unlock(hcd->address0_mutex); ++ + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); + +@@ -5294,6 +5296,7 @@ static void hub_port_connect(struct usb_ + + loop_disable: + hub_port_disable(hub, port1, 1); ++ mutex_lock(hcd->address0_mutex); + loop: + usb_ep0_reinit(udev); + release_devnum(udev); +@@ -5320,6 +5323,8 @@ loop: + } + + done: ++ mutex_unlock(hcd->address0_mutex); ++ + hub_port_disable(hub, port1, 1); + if (hcd->driver->relinquish_port && !hub->hdev->parent) { + if (status != -ENOTCONN && status != -ENODEV) +@@ -5839,6 +5844,8 @@ static int usb_reset_and_verify_device(s + bos = udev->bos; + udev->bos = NULL; + ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < PORT_INIT_TRIES; ++i) { + + /* ep0 maxpacket size may change; let the HCD know about it. +@@ -5848,6 +5855,7 @@ static int usb_reset_and_verify_device(s + if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV) + break; + } ++ mutex_unlock(hcd->address0_mutex); + + if (ret < 0) + goto re_enumerate; diff --git a/queue-5.10/usb-serial-option-add-fibocom-fm101-gl-variants.patch b/queue-5.10/usb-serial-option-add-fibocom-fm101-gl-variants.patch new file mode 100644 index 00000000000..487cda57c28 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-fibocom-fm101-gl-variants.patch @@ -0,0 +1,688 @@ +From 88459e3e42760abb2299bbf6cb1026491170e02a Mon Sep 17 00:00:00 2001 +From: Mingjie Zhang +Date: Tue, 23 Nov 2021 21:37:57 +0800 +Subject: USB: serial: option: add Fibocom FM101-GL variants + +From: Mingjie Zhang + +commit 88459e3e42760abb2299bbf6cb1026491170e02a upstream. + +Update the USB serial option driver support for the Fibocom +FM101-GL Cat.6 +LTE modules as there are actually several different variants. +- VID:PID 2cb7:01a2, FM101-GL are laptop M.2 cards (with + MBIM interfaces for /Linux/Chrome OS) +- VID:PID 2cb7:01a4, FM101-GL for laptop debug M.2 cards(with adb + interface for /Linux/Chrome OS) + +0x01a2: mbim, tty, tty, diag, gnss +0x01a4: mbim, diag, tty, adb, gnss, gnss + +Here are the outputs of lsusb -v and usb-devices: + +T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 86 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=01a2 Rev= 5.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom FM101-GL Module +S: SerialNumber=673326ce +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none) +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none) +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none) + +Bus 002 Device 084: ID 2cb7:01a2 Fibocom Wireless Inc. Fibocom FM101-GL Module +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 3.20 + bDeviceClass 0 + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 9 + idVendor 0x2cb7 + idProduct 0x01a2 + bcdDevice 5.04 + iManufacturer 1 Fibocom Wireless Inc. + iProduct 2 Fibocom FM101-GL Module + iSerial 3 673326ce + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x015d + bNumInterfaces 6 + bConfigurationValue 1 + iConfiguration 4 MBIM_DUN_DUN_DIAG_NMEA + bmAttributes 0xa0 + (Bus Powered) + Remote Wakeup + MaxPower 896mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 14 + bFunctionProtocol 0 + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 14 + bInterfaceProtocol 0 + iInterface 5 Fibocom FM101-GL LTE Modem + CDC Header: + bcdCDC 1.10 + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 + CDC MBIM: + bcdMBIMVersion 1.00 + wMaxControlMessage 4096 + bNumberFilters 32 + bMaxFilterSize 128 + wMaxSegmentSize 2048 + bmNetworkCapabilities 0x20 + 8-byte ntb input size + CDC MBIM Extended: + bcdMBIMExtendedVersion 1.00 + bMaxOutstandingCommandMessages 64 + wMTU 1500 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 9 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 0 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 1 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 6 MBIM Data + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x8e EP 14 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 6 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x0f EP 15 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 2 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 48 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + +T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 85 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2cb7 ProdID=01a4 Rev= 5.04 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom FM101-GL Module +S: SerialNumber=673326ce +C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none) +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none) +I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none) + +Bus 002 Device 085: ID 2cb7:01a4 Fibocom Wireless Inc. Fibocom FM101-GL Module +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 3.20 + bDeviceClass 0 + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 9 + idVendor 0x2cb7 + idProduct 0x01a4 + bcdDevice 5.04 + iManufacturer 1 Fibocom Wireless Inc. + iProduct 2 Fibocom FM101-GL Module + iSerial 3 673326ce + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x0180 + bNumInterfaces 7 + bConfigurationValue 1 + iConfiguration 4 MBIM_DIAG_DUN_ADB_GNSS_GNSS + bmAttributes 0xa0 + (Bus Powered) + Remote Wakeup + MaxPower 896mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 14 + bFunctionProtocol 0 + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 14 + bInterfaceProtocol 0 + iInterface 5 Fibocom FM101-GL LTE Modem + CDC Header: + bcdCDC 1.10 + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 + CDC MBIM: + bcdMBIMVersion 1.00 + wMaxControlMessage 4096 + bNumberFilters 32 + bMaxFilterSize 128 + wMaxSegmentSize 2048 + bmNetworkCapabilities 0x20 + 8-byte ntb input size + CDC MBIM Extended: + bcdMBIMExtendedVersion 1.00 + bMaxOutstandingCommandMessages 64 + wMTU 1500 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 9 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 0 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 1 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 + bInterfaceProtocol 2 + iInterface 6 MBIM Data + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x8e EP 14 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 6 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x0f EP 15 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 2 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 48 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 66 + bInterfaceProtocol 1 + iInterface 8 ADB Interface + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 6 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 + bInterfaceProtocol 64 + iInterface 0 + ** UNRECOGNIZED: 05 24 00 10 01 + ** UNRECOGNIZED: 05 24 01 00 00 + ** UNRECOGNIZED: 04 24 02 02 + ** UNRECOGNIZED: 05 24 06 00 00 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x89 EP 9 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x000a 1x 10 bytes + bInterval 9 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x05 EP 5 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0400 1x 1024 bytes + bInterval 0 + bMaxBurst 0 + +Signed-off-by: Mingjie Zhang +Link: https://lore.kernel.org/r/20211123133757.37475-1-superzmj@fibocom.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2096,6 +2096,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ diff --git a/queue-5.10/usb-serial-option-add-telit-le910s1-0x9200-composition.patch b/queue-5.10/usb-serial-option-add-telit-le910s1-0x9200-composition.patch new file mode 100644 index 00000000000..cca2b13598c --- /dev/null +++ b/queue-5.10/usb-serial-option-add-telit-le910s1-0x9200-composition.patch @@ -0,0 +1,33 @@ +From e353f3e88720300c3d72f49a4bea54f42db1fa5e Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Fri, 19 Nov 2021 15:03:19 +0100 +Subject: USB: serial: option: add Telit LE910S1 0x9200 composition + +From: Daniele Palmas + +commit e353f3e88720300c3d72f49a4bea54f42db1fa5e upstream. + +Add the following Telit LE910S1 composition: + +0x9200: tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20211119140319.10448-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1267,6 +1267,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ + .driver_info = NCTRL(0) | ZLP }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, diff --git a/queue-5.10/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch b/queue-5.10/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch new file mode 100644 index 00000000000..1a38011e4ea --- /dev/null +++ b/queue-5.10/usb-typec-fusb302-fix-masking-of-comparator-and-bc_lvl-interrupts.patch @@ -0,0 +1,66 @@ +From 362468830dd5bea8bf6ad5203b2ea61f8a4e8288 Mon Sep 17 00:00:00 2001 +From: Ondrej Jirman +Date: Mon, 8 Nov 2021 11:28:32 +0100 +Subject: usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts + +From: Ondrej Jirman + +commit 362468830dd5bea8bf6ad5203b2ea61f8a4e8288 upstream. + +The code that enables either BC_LVL or COMP_CHNG interrupt in tcpm_set_cc +wrongly assumes that the interrupt is unmasked by writing 1 to the apropriate +bit in the mask register. In fact, interrupts are enabled when the mask +is 0, so the tcpm_set_cc enables interrupt for COMP_CHNG when it expects +BC_LVL interrupt to be enabled. + +This causes inability of the driver to recognize cable unplug events +in host mode (unplug is recognized only via a COMP_CHNG interrupt). + +In device mode this bug was masked by simultaneous triggering of the VBUS +change interrupt, because of loss of VBUS when the port peer is providing +power. + +Fixes: 48242e30532b ("usb: typec: fusb302: Revert "Resolve fixed power role contract setup"") +Cc: stable +Cc: Hans de Goede +Reviewed-by: Hans de Goede +Acked-by: Heikki Krogerus +Signed-off-by: Ondrej Jirman +Link: https://lore.kernel.org/r/20211108102833.2793803-1-megous@megous.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/fusb302.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/fusb302.c ++++ b/drivers/usb/typec/tcpm/fusb302.c +@@ -669,25 +669,27 @@ static int tcpm_set_cc(struct tcpc_dev * + ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK, + FUSB_REG_MASK_BC_LVL | + FUSB_REG_MASK_COMP_CHNG, +- FUSB_REG_MASK_COMP_CHNG); ++ FUSB_REG_MASK_BC_LVL); + if (ret < 0) { + fusb302_log(chip, "cannot set SRC interrupt, ret=%d", + ret); + goto done; + } + chip->intr_comp_chng = true; ++ chip->intr_bc_lvl = false; + break; + case TYPEC_CC_RD: + ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK, + FUSB_REG_MASK_BC_LVL | + FUSB_REG_MASK_COMP_CHNG, +- FUSB_REG_MASK_BC_LVL); ++ FUSB_REG_MASK_COMP_CHNG); + if (ret < 0) { + fusb302_log(chip, "cannot set SRC interrupt, ret=%d", + ret); + goto done; + } + chip->intr_bc_lvl = true; ++ chip->intr_comp_chng = false; + break; + default: + break; -- 2.47.2